move-on-by

36 ms·

421.
by move-on-by 8y ago
Steven Black's list sources from multiple lists as well. Checking out your lie-to-me project, there is actually a lot of overlap between what Steven is already pulling in and what you are getting. Looks like one of your sources 'p
422.
by move-on-by 8y ago
I setup a test page for this, and it seems you are right. Test 1: * Feature-Policy "microphone https://example.com" * Javascript that accesses microphone hosted on example.com * Everything loaded an
423.
by move-on-by 8y ago
It most definitely will, did you read the article? <origin(s)> allows you to define what script origin have access to what features. The example you bring up where a script modifies the page to do something would require the 'sel
424.
by move-on-by 8y ago
Yes, defense in depth. Do your due diligence, vet what you can, and then lock it down where trust isn't even required. Sites get hacked, whether its CDNs, ad networks, or any other trusted 3rd party. A great example would be a website
425.
by move-on-by 8y ago
Think of these headers not so much as security. Just because a site doesn't have this or other headers doesn't make it any less secure. The headers are better described as fine-tuned access-control policies. You want to be able to
426.
by move-on-by 8y ago
I was in a very similar situation. Overworked, but got a bit of a break due to family leave. When I came back, I was met with a lot of aggression and blame that I had never experienced at that job before. I was still overworking but not at
427.
by move-on-by 8y ago
Like I said, the burden at that point is on the users
428.
by move-on-by 8y ago
> Pinning is what is done by sites like gmail to prevent third world dictatorships from using stolen certificate credentials to spy on their citizens. People who have been victims of this have had their email read, been arrested by state
429.
by move-on-by 8y ago
> Travel can be more difficult if not near a central airline hub. Oh this is a great addition. Remote jobs often have an element of travel involved. Only having a small regional airline means a least 1 layover minimum and limited time op
430.
by move-on-by 8y ago
I have a remote job _because_ I live in the countryside. I'm very happy with my job, but its not a walk in the park being remote. * Most companies want to pay you based on your location. If you are already in a the countryside when get
431.
by move-on-by 8y ago
A Pi-hole is the only real solution for this as far as I can tell if you still want to use apps on your TV like Netflix. I use a Pi-hole as well with several block list sources, my favorite being Steven Black's hosts: https:/&#x2
432.
by move-on-by 8y ago
Yeah, identity doesn't count for much when its easily lost. Look at all the issues we have today with identity theft. Attaching identities to more things would make it worse, perhaps to the point where its meaningless
433.
by move-on-by 8y ago
> If we were talking to a bad guy then we're screwed. But if we are talking to our intended recipient, even if their cert is bogus, our connection is protected from bad guys on the path. You acknowledge that you don't know who
434.
by move-on-by 8y ago
From my understanding, this is pretty much the same thing as the HSTS preload list[1], except for SMTP servers instead of HTTPS servers. It has two main goals. First, encourage cert validations. If you don't validate a cert, it means n
435.
by move-on-by 8y ago
Isn't that what the DNS Certification Authority Authorization (CAA) DNS record [1] is supposed to solve? Combine that with certificate transparency enforced with the `Expect-CT` header [2] and its pretty locked down. If a CA does not r
436.
by move-on-by 8y ago
Nothing, that's one reason why these companies exist. Its corporate surveillance
437.
by move-on-by 8y ago
I have that setting as well. The new config specifically for this is "browser.newtabpage.activity-stream.showSponsored", you might want to flip it too just in case. The config name doesn't specifically reference pocket - so p
438.
by move-on-by 8y ago
If its just you, then you just have to file a Schedule C. More details on IRS: https://www.irs.gov/businesses/small-businesses-self-employe... Disclaimer, not a CPA or lawyer, this is not legal advice
439.
by move-on-by 8y ago
As someone who uses a custom domain email address, this makes me sad
440.
by move-on-by 9y ago
> To be clear, I'm not saying that support for async crypto isn't worthwhile, but I'll strenuously object to making it the default without extensive evidence that it doesn't introduce performance regressions. Pretty b
441.
by move-on-by 9y ago
Could be, could also be API clients not doing cert validations
442.
by move-on-by 9y ago
I'm not able to find any information on Let's Encrypt and DNSSEC validation. Anyone know if they validate it?
443.
by move-on-by 9y ago
> you can prevent this by setting CAA DNS records on your own domain Well this is interesting, I already have a CAA DNS record on my root domain, but of course its also set to 'letsencrypt.org' since that is what I use on my ro
444.
by move-on-by 9y ago
I can see why the FCC might be hesitant to get involved with these segments and scripts. However, the Sinclair merger should unequivocally be rejected. This business pattern only becomes an issue once you get monopolies and oligopolies. We